Information-Theoretic Feature Selection via Variational Autoencoders for Network Intrusion Detection: A Mutual Information Maximization Approach

Abstract

Feature selection is a critical preprocessing step for network intrusion detection systems (IDS), yet conventional methods operate exclusively in the original feature space and fail to exploit the probabilistic structure of network traffic data. This paper proposes IT-VAE-FS (Information-Theoretic VAE-based Feature Selection), a novel framework that leverages the latent representations learned by a β-Variational Autoencoder as an information-theoretic reference frame for principled feature evaluation. The framework introduces a composite feature importance score integrating three complementary measures: (i) the mutual information between each input feature and the VAE’s latent representation, estimated via the InfoNCE lower bound; (ii) the feature’s contribution to the KL divergence component of the Evidence Lower Bound; and (iii) the feature’s reconstruction sensitivity. A redundancy-aware greedy selection procedure, inspired by the minimum Redundancy Maximum Relevance criterion, identifies compact feature subsets that maximize informational coverage while minimizing inter-feature redundancy. Extensive experiments on three benchmark datasets CICIDS-2017, UNSW-NB15, and NSL-KDD demonstrate that IT-VAE-FS consistently outperforms nine established feature selection baselines spanning the filter, wrapper, embedded, and deep learning-based categories. Using only 20 selected features; the framework achieves F1-scores within 0.06–0.16 percentage points of the full-feature baseline while reducing dimensionality by 51–74%, yielding a 3.3× inference speedup. An ablation study confirms the complementarity of all three scoring components, and the statistical significance of the results is established through Friedman and Wilcoxon signed-rank tests with Holm-Bonferroni correction (  for all pairwise comparisons). The formal connection between the β-VAE objective and the information bottleneck principle provides theoretical justification for using the latent space as a feature evaluation reference frame, situating the contribution within a well-established information-theoretic framework.